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APOLLO EXPERIENCE REPORT 


LUNAR MODULE ELECTRICAL POWER SUBSYSTEM 

By Arturo B. Campos 
Manned Spacecraft Center 

SUMMARY 


The lunar module electrical power subsystem controlled, conditioned, and distrib- 
uted all electrical power in the lunar module. The subsystem was required to receive 
direct- current power from batteries and distribute it to equipment in both direct- and 
alternating- current forms. The subsystem was developed to include equipment for in- 
version of power, circuit protection, distributed networks, controls, and monitoring 
functions. In this report, the system design, the testing program, and the problems 
encountered throughout the program are described. 


INTRODUCTION 


The contract for the lunar module (LM) was awarded in 1963. The electrical 
power requirements were defined to provide approximately 65 kilowatt-hours at a rate 
of 4000 watts to satisfy a 35-hour lunar staytime. The subsystem was designed to fail- 
safe within the weight constraints; this requirement necessitated the use of redundant 
buses and isolation equipment. Inversion equipment was provided to meet the require- 
ments of the equipment powered by alternating current (ac). Conversion equipment was 
provided to satisfy the requirements for levels of direct- current (dc) power other than 
the nominal 28 V dc obtained from the source. Circuit protection was provided by 
thermal circuit breakers, fuses, and electronic circuitry. The subsystem design, de- 
velopment, and flight history are discussed, with emphasis on the problems encountered 
and resolutions. 



SUBSYSTEM DESCRIPTION 


Originally, the electrical power subsystem (EPS) was designed to accommodate a 
fuel-cell source as depicted in figure 1. The initial EPS specification included the fol- 
lowing major components. 

1. Three fuel cells (28 V dc, 1100 watts each) 

2. Three electrical supervisory panels (to ensure control and protection for each 
fuel cell) 

3. Two or three inverters (350 volt-amperes, 115 V ac, 400 hertz, single phase) 

4. One lighting-control assembly (LCA) (for power conversion and variable volt- 
age control for lighting equipment) 

5. Peaking battery and battery charger (The battery was needed to satisfy the 
4000-watt power requirement. ) 



Figure 1.- Alternating- and direct-current distribution conceptual design using fuel cells. 
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Because of the fuel-cell complexity, the development costs, and the schedule 
problems, the prime contractor was directed to convert to an all-battery system. 

Later requirements for the additional power necessary for the increased lunar stay- 
time (from 35 to 72 hours) resulted in an added descent-stage battery and a battery- 
control relay assembly. The final subsystem design consisted of the dc, ac, and 
lighting systems. 

In the dc system, five descent-stage batteries, rated at 400 ampere-hours each, 
and two ascent-stage batteries, rated at 300 ampere-hours each, were used. Two 
electrical- control assembly (ECA) units were placed in the descent stage for the con- 
trol and protection of all descent-stage batteries. One ECA was used for each ascent- 
stage battery. To transfer power from the batteries to the dc bus, two feeder systems 
consisting of redundant power wires were used. The relay junction box contained an 
electrical contact to disconnect (deadface) the descent- stage feeder from the ascent- 
stage feeder leading to the lunar module pilot (LMP) bus. The deadface relay box was 
! used to disconnect the descent- stage feeder from the ascent- stage feeder leading to the 
commander (CDR) bus. One LMP bus and one CDR bus were located in the displays 
and controls panels. The battery-control relay assembly was installed to switch the 
measurement information from one battery to another battery of the three descent- stage 
batteries that shared telemetry channels. 

In the ac system, two inverters (each rated at 350 volt-amperes, 400 hertz, 

115 V ac, single phase) were used. The ac bus was located in the LMP power panel. 

In the lighting system, one LCA was used to provide variable ac and dc power for 
interior and exterior lighting. 


SUBSYSTEM TESTING PROGRAM 


To ensure adequate system and component operation, a testing program was 
established that included the following tests. 

1. Design-feasibility tests were performed on breadboards to establish confi- 
dence in design parameters and to aid in selection of parts. 

2. Design- verification tests were performed on working models in varying en- 
vironmental conditions to ascertain hardware performance before a commitment was 
made to produce the flight hardware. 

3. Qualification tests generally were performed on at least two flight- type units. 
One unit was tested to design limits; the other, to endurance limits. These tests were 
designed to prove that the hardware would satisfy specification requirements. 

4. Acceptance tests were performed on each flight unit to check such conditions 
as vibration, temperature, and electrical functions to ensure the capability of the unit 
to fulfill the technical requirements. 
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5. Preinstallation tests were performed on each flight unit to determine whether 
the unit had been damaged after the acceptance tests were performed by the vendor. 

6. Subsystem- development tests were performed on production hardware assem- 
bled into a working subsystem to ensure that subsystem characteristics (voltage, ripple, 
etc.), performance, control, and protection satisfied the system requirements. 


COMPONENT DEVELOPMENT 


Direct-Current System 

The dc system consisted of the power source (batteries), the control and protec- 
tion of the power source (ECA units), the feeder system to route the power from the 
source to the buses, the interface control (relay junction box and deadface relay box) 
between the descent- and the ascent-stage feeders, the two dc buses, and the controls 
for switching batteries and other electrical information (battery-control relay 
assembly). 

Batteries. - To achieve an overall low effective weight, five 400-ampere-hour 
batteries were located in the descent stage and two 300-ampere-hour batteries were 
located in the ascent stage. These battery energy ratings were for a nominal bus volt- 
age of 28 V dc under load. 

Electrical control assemblies . - Two ECA units were required for the descent 
stage. Each unit originally controlled two of the four descent-stage batteries. Each 
of the two sections of each ECA unit controlled the output of a battery having a low- 
voltage tap connection (17 cells) and a high-voltage tap connection (20 cells). The low- 
voltage tap prevented overvoltage during early low-load periods (e. g. , prelaunch). 

When the fifth descent- stage battery was added, the low-voltage tap connection from 
only one section of each descent- stage ECA was used to switch and control the fifth 
battery (fig. 2). Thus, the need for a third ECA was eliminated. This action resulted 
in the capability to connect the fifth battery to either bus. Each descent- stage ECA 
protected each battery from overcurrent by automatically disconnecting the battery from 
the system when an overload on the battery exceeded 160 amperes. Also, indications 
were provided when reverse current exceeded 10 amperes or when battery tempera- 
tures exceeded 145° F. 

Two ECA units were required for the ascent stage; each unit controlled the con- 
nection of an ascent battery to two feeder systems. Only the normal distribution feeder 
connection for the ascent- stage battery had the automatic overcurrent protection. The 
backup connection overcurrent capability was deleted to eliminate weight. 

During the development of the ECA units, two conditions forced design changes. 
First, the high vibration level caused relay- contact chatter because of the ascent- stage 
ECA location. This condition was discovered when the ECA was tested while mounted 
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on the secondary structure simulator to expected flight- qualification levels. Because of 
the high vibration levels, the prime spacecraft contractor relocated the ascent- stage 
ECA from the cantilevered cold rails on the aft equipment rack to a position within the 
rack. In this new location, the lower resulting vibration level did not cause contact 
chatter when the ECA was retested with the structure simulator. 

The second condition that forced design changes occurred during the subsystem- 
development tests. It was discovered that the short-circuit current of an LM battery 
(1700 amperes) was much higher than the current- interrupt capacity of the 1100-ampere 
contactor. When the contactor was tested with flight-type batteries, the contact 
button of the contactor separated. This failure resulted from the heat generated by the 
1700-ampere current. The contact buttons and the bridge were modified by changing 
the bonding process between the cadmium alloy and silver from brazing to diffusion 
bonding and increasing the length of the bridge by 0. 045 inch. The diffusion bonding of 
the contact layers resulted in less contact resistance and therefore a lower heat buildup. 
The lengthened bridge, containing the contacts, allowed greater heat removal from the 
contacts and maintenance of structural rigidity at the greater temperature. The elec- 
tronic device for tripping the contactor was modified to obtain faster triptimes for 
short-circuit currents greater than 1100 amperes. These modifications were made on 
all ascent-stage and descent-stage ECA units. 

Feeder system . - Two American wire gage 6 wires were used in each positive leg 
of the redundant feeder system. The vehicle primary structure was used for the return. 
The feeder system providing power from the batteries to the LMP bus was routed on the 
right-hand side of the vehicle, and the CDR bus feeder system was routed on the left- 
hand side. Each feeder system started at each descent-stage and ascent- stage ECA 
(fig. 2). The descent-stage portion of the feeder system was connected to the ascent- 
stage portion just beyond the relay junction box on the LMP side and just beyond the 
deadface relay box on the CDR side. 

During ground testing of LM test article 8 and just after the LMP power panel had 
been installed, the vehicle feeder system on the LMP side failed (shorted to ground). 

The feeder wires on the back side of the LMP power panel had been trapped and dam- 
aged because of insufficient clearance between the panel structure and the vehicle struc- 
ture. The system was modified by the addition of spacers to the power panel to allow 
more clearance. Again, during testing, the wires were found to be damaged after re- 
installation of the panel in the vehicle. This problem finally was solved by flattening 
the rounded harness and securing the harness with rectangular clamps. 

During the ground testing of LM-2, the descent- stage feeder system on the LMP 
side began to arc and smoke. The feeder wire was found to be damaged and burned 
under a cable clamp. The problem, caused by an undersized clamp that damaged the 
H-film primary insulation of the feeder wire, was corrected by the installation of heat- 
shrinkable tubing along the entire length of the feeder system and the use of properly 
sized cable clamps. 
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Relay junction box and deadface relay box . - The relay junction box contained 
diodes and junctions for the various battery controls from the automatic checkout equip- 
ment, the LM cabin, and the command module (CM). Additionally, the relay junction 
box and the deadface relay box isolated the descent-stage portion of the feeder system 
just before staging of the LM vehicle. 

The dc buses . - Two main dc buses were provided for redundancy. The following 
load groupings were provided. 
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1. Redundant loads, one on each bus 

2. Nonredundant critical loads, powered from both buses with diode isolation 

3. Noncritical nonredundant loads, powered from either bus 




For cases in which two loads could perform the same function in a different man- 
ner, one load was tied to the first bus and the other load was tied to the second bus, a 
procedure called load grouping for functional redundancy. 

Redundant loads (such as the two inverters, the system A and B reaction-control 
quad heaters with control circuitry, and the two sets of ultra-high-frequency and very- 
high-frequency transceivers) were placed on separate buses. Nonredundant critical 
loads (such as battery controls) were put on both buses (with diode isolation). Func- 
tional redundancy loads (such as electroluminescent (EL) lighting, incandescent flood- 
lights, primary guidance, and abort guidance) were placed on separate buses to prevent 
loss of that function if a bus were lost. 

After the fire in Apollo CM 012, fire-retardant materials were added to cover the 
flammable potting material, the circuit breakers, and the buses. During the acceptance 
testing of the power panels, the insulation resistance was found to vary from 1 to 
10 megohms depending on humidity. The minimum requirement was 100 megohms. 

The fire-retardant material used by the prime contractor was found to be nonhygro- 
scopic, but the Beta- cloth bootees that covered the circuit breakers were hygroscopic. 
Because test results proved that the insulation-resistance reading stabilized at values 
greater than 1 megohm, the specification was changed to 1 megohm. Leakage current 
of a few microamperes was not a problem, because a 30- microampere loss for the mis- 
sion duration amounted to approximately 5 milliampere-hours of a total battery capacity 
of 2675 ampere-hours. 

Battery-control relay assembly . - The addition of the fifth battery on the descent 
stage dictated the requirement for the battery-control relay assembly (a relay box). 

This assembly could be used to switch the battery information into existing measure- 
ment channels. Thus, further complication of the instrumentation subsystem and in- 
creasing the vehicle weight by the addition of another ECA were avoided. 

Relays and circuit breakers . - The original LM relay specification stipulated that 
as many as 32 poles should be included to save weight in the relay-box designs. The 
original relays, designed and made to these requirements, failed to satisfy the vibra- 
tion requirements. Consequently, the off-the-shelf, previously qualified relays were 
selected and placed in relay boxes that had been redesigned to accommodate a larger 
number of smaller sized relays with fewer contacts. 

Early in the flight program, these relays actuated intermittently. The problem 
was caused by metallic and nonmetallic contamination that prevented the armature from 
operating fully. A screening process (high- vibration testing designed to excite the 
small particles that caused the contamination while the relay was tested electrically) 
was imposed on all relays used in the EPS. Early vehicles were retrofitted with se- 
lected screened relays, depending on criticality. 

Hermetically sealed circuit breakers were specified; however, the manufacturer 
was unable to qualify this type of breaker because of assembly problems. One assem- 
bly problem was the critical process of fitting the major circuit-breaker assembly 
(containing the pushbutton, the bridge contacts, and the bimetallic element) into the 
hermetic sealing can. Because the can contained the contacts that mated with the 
bridge contacts, a specific contact pressure was difficult to obtain when the two parts 
were assembled and sealed with solder. Failures resulting from the lower contact 
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pressure included contact chatter, high contact resistance in dry circuit testing, and 
high voltage drop. The contract was modified to include the purchase of qualified 
command- service module (CSM) circuit breakers from the same manufacturer. These 
breakers were sealed environmentally rather than hermetically. The problems en- 
countered during the development of the circuit-breaker panel and the eventual solutions 
to these problems are discussed in the following paragraphs. 


During circuit-breaker-panel assembly, the prime contractor baked the panels to 
accelerate the curing of the sealing compound used on the circuit-breaker terminals. 
During panel-acceptance testing, it was found that this baking had caused a deformation 
of the breaker case and internal structure, resulting in a shift in the calibration curve 
of the breaker by as much as 50 percent. To solve the problem, the circuit-breaker 
manufacturer changed the internal structure material from melamine to diallyl phthal- 
ate, which had better thermal stability. 

After the fire in Apollo CM 012, the prime contractor covered the circuit breakers 
with Beta-cloth bootees to stop the propagation of a fire. Subsequently, cracks were 
found in the case around the base of the threaded mounting bushing of some hot-wire- 
type breakers. Two factors contributed to this condition. Firstly, the circuit-breaker 
load-bearing mounting surface was subjected to uneven stresses because of crumpled 
Beta cloth between the mounting surface and the panel. Secondly, the load-bearing area 
of the breaker threaded bushing had been reduced by a product- improvement change. 


The prime contractor modification to resolve this problem was twofold. The 
Beta-cloth-bootee design was changed from the so-called tobacco pouch design, in 
which a string was drawn to close the pouch around the mounting bushing, to one that 
incorporated a piece of flat plastic between 
the circuit-breaker mounting surface and 


the panel (fig. 3). In addition, the torque 
on the threaded-bushing mounting nut was 
reduced from 30 to 20 inch-pounds. The 
effectiveness of a good mount at the lower 
torque values was proven by means of 
testing. 


Dotted line shows change 



— 0.020 + 0.010 tn. 
080 in 




Product improvement change to circuit breaker 
case that created higher stress point 

Detail A 


When the prime contractor instituted 
trip-characteristic testing in the fall of 
1968, it was found that some bimetallic 
circuit breakers did not trip. Both Apollo 
spacecraft prime contractors assisted the 
breaker manufacturer in performing elec- 
trical trip testing on approximately 
100 circuit breakers. Based on the test 
results, it was stipulated that the electri- 
cal trip life should be limited to 20 trip 
cycles, an NASA-approved specification 
change. Failure analysis of circuit break- 
ers indicated that, with increasing trip- 
time, the bimetallic plate seemed to bind 
with the latching bracket as shown in 
figure 4. 


ot added here 
view ol bushing 

Product- improvement change that reduced bushing bearing area 
Detail B 


Bearing area (typical' 


Bottom 



Figure 3. - Circuit-breaker-case 
improvements. 
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Figure 4. - Lunar module bimetallic circuit breakers. 


Alternating-Current System 

The ac system was essentially a decentralized system in which most users of ac 
power performed conversion from dc power internally. Only a few loads required ac 
power from an external source. Initially, the environmental control system was to 
contain ac motors to drive pumps and fans; however, brushless dc motors, which were 
being developed, were selected. Even though the remaining ac power requirement was 
low, the inverter already had been sized to accept the total ac motor loads. The ac 
system consisted of two inverters, a feeder system for each inverter, two ac buses for 
the high-power side, and one common bus for the low-power side. 

Two inverters were installed, although only one inverter could be used at a time. 
The other inverter served as a redundant inverter but could be energized and left idling 
during critical mission times. Each inverter was rated at 350 volt-amperes, 400 hertz, 
115 V ac, single phase. 

By means of the inverter design, two weight- saving innovations were introduced: 
a ramp-type boost regulator (replacing a buck-boost transformer type) and silicon- 
controlled rectifier (SCR) units for the inversion sections. The ramp-boost- regulator 
design was satisfactory, but the SCR switching was uneven and random. Consequently, 
the inverter design was changed to incorporate standard transistor switching. 

Before qualification testing was completed, a major design problem was found: 
the inverter could not fulfill the voltage-modulation specifications at the low frequencies 
when the specified input line ripple (3 volts peak to peak, 0 to 15 kilohertz) was intro- 
duced. The output-voltage modulation was 18 volts but should not have exceeded 
2. 5 volts peak to valley (ref. 1). In a phase II design, the inverter was modified to 
include a demodulator circuit (fig. 5). With the demodulator circuit, the output-voltage 
modulation was approximately 4 volts. A test performed on LM test article 1, an early 
test vehicle, provided data from which it was shown that dc input contained a ripple of 
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a few millivolts and sharp (2 volts maximum) spikes. On the basis of this knowledge, 
the inverter input-voltage requirements were changed to specify only 2 volts peak to 
peak from 20 to 250 hertz and 3 volts peak to peak from 250 hertz to 15 kilohertz. After 
this test and the subsequent specification change, the phase II inverter satisfied the 
voltage- modulation requirements. 


Auxiliary power, 40 V dc 



Figure 5. - Lunar module general-purpose inverter block diagram. 
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After qualification, an inverter in the LM-3 vehicle failed preflight. The output 
of the inverter was intermittent. The problem was attributed to separation of the 
oscillator-capacitor lead solder. When the joint on the qualification unit was inspected, 
the same solder separation as that observed on the failed LM-3 joint was noted. When 
the joints were further examined, it was determined that the condition was attributable 
to the nonwetting characteristics of the metals used in the lead fabrication; that is, 
dumet lead material on the capacitor, copper flashing of this lead, and tin-dipping of 
the lead in 50/50 solder. This 50/50 solder made the lead noncompatible as explained 
in the following paragraph. 

The oscillator-capacitor lead was soldered to the gold plating on the printed cir- 
cuit board with 63/37 eutectic solder, which has no plastic state. Therefore, during 
cooling of the joint after the final soldering, the eutectic solder hardened immediately, 
but the 50/50 solder remained in the plastic state longer and then separated when it 
hardened. The LM-3 and subsequent inverters were reworked by unsoldering the joint, 
removing the 50/50 solder, and resoldering with eutectic solder while applying flux. 


Lighting System 

The lighting system consisted of one LCA, three potentiometers (to control the 
20- to 118-V ac annunciator /numeric lighting power, the 15- to 75-V ac integral lighting 
power, and the 0- to 5-V dc integral lighting power), and one rheostat (to control the 
28-V dc power to the flood lights). 

The LCA consisted of the following components. 

1. A high-power ac voltage regulator module (15- to 75-V ac output with remote 
potentiometer control) for the LM integral EL lighting 

2. A low-power ac voltage regulator module (20- to 118-V ac output with remote 
potentiometer control) for the annunciator/numeric EL lighting 

3. Two dc-to-dc converter modules (5. 5-V dc output) 

4. A series dc regulator circuit (2- to 5-V dc output with remote potentiometer 
control) for the dc integral lighting and the caution and warning lights 

5. A short- circuit-protection module (5-V dc output) for the docking lights 

During the ground testing of LM-3 at the prime contractor's plant, an electromag- 
netic interference problem was found to cause noise in the communication headset and 
a shift in the flight director attitude indicator. In the process of troubleshooting, two 
LCA units were damaged when inadvertent grounding of the LCA circuit through a 
grounded oscilloscope caused failure of a zener diode and the remote- control potentiom- 
eter. Two problems were revealed. Firstly, a steady-state noise level of 0. 2 to 
0. 4 volt, 4 to 10 megahertz, was seen on the 2- to 5-volt circuit. Secondly, a transient 
peak voltage of 20 to 25 volts at 250 kilohertz during initial turnon was seen on the 
15-volt output of the dc-to-dc converters. The energy contents of the transient and the 
noise were considered negligible insofar as causing permanent damage to the LCA. 
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Circuit analysis and testing by the vendor indicated that the noise originated in 
the 15- volt section that provided power to the dimmer and current- limiting circuits and 
that decoupling was needed between the switching elements in the dimmer- limiter mod- 
ules. The decoupling capacitors and filter capacitors installed in the various modules 
to solve the problem are shown in figure 6. 



Figure 6. - Lighting- control dc section. 


FLIGHT PERFORMANCE 


The flight of the LM-1 vehicle completed the qualification requirements for the 
EPS. During the descent-stage burns, the ac power system that supplied power to the 
engine gimbal motors exhibited intermittent high and low voltages. This event was 
duplicated in later special tests by using the gimbal actuators and an inverter. The 
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high voltage of 125 volts and the low voltage of 110 volts were caused by the inverter 
response to the pulsing of the gimbal motors. When the load was removed and the in- 
verter load dropped below 50 volt-amperes, the inverter (in trying to maintain a regu- 
lated voltage) produced an oscillating output that lasted approximately 100 milliseconds, 
during which time the gimbal motors were turned on and off several times each second. 
This switching caused the transients on the inverter output. 

Manning of the subsequent spacecraft resulted in increased loading on the ac bus. 
The additional load prevented the transient from recurring, and the EPS performed 
satisfactorily. 

On the LM-7 (Apollo 13) flight, the EPS supplied electrical energy to the CM for 
recharging and conserving energy in the CM batteries. Transfer of power to the CM 
was not a design requirement; however, during a premission simulation, the idea of 
transferring power to the CM in case of an emergency had been proposed. A prelim- 
inary procedure was submitted and implemented. After the successful transfer of 
power to the Apollo 13 CM, additional changes in the LM-8 and LM-9 vehicles estab- 
lished (1) the capability for the LM to initiate the power transfer, (2) the protection of 
the LM buses during power transfer to the CM by added circuit protection, and (3) the 
capability to accomplish power transfer to the CM after LM staging. Before this final 
change was implemented, staging of the LM disrupted the transfer logic circuits. 


CONCLUSIONS AND RECOMMENDATIONS 


The lunar module electrical power subsystem has fulfilled the mission require- 
ments and no inflight failures have occurred. After the initial failures on developmental 
equipment, some contracts were cancelled and off-the-shelf hardware was used. The 
initiation of higher levels of acceptance vibration testing and thermal testing greatly 
reduced the number of failures in the vehicle. 

For new programs, it is advisable to start with a realistic but conservative speci- 
fication for electrical power characteristics applicable to all subsystems. Such a 
specification will allow all engineers to design equipment to withstand the same electri- 
cal requirements such as transients, ripple, modulation, and so forth. A properly 
written specification also will enable the prime contractor to impose a standard series 
of electrical tests on vendor equipment. 

On major assemblies that require fuses for circuit protection, the fuses should be 
located for easy replacement. Presently, some lunar module equipment (such as the 
electrical- control assembly and lighting-control assembly) has to be removed and tedi- 
ously reworked for replacement of blown fuses. 

Important measurements such as bus voltages and source currents should be 
assigned a high sampling rate to detect and analyze real-time, unexpected voltage and 
current anomalies. Presently, the lunar module electrical power subsystem has a one- 
sample-per-second rate; the rate should be 10 or more samples per second (preferably 
more). An incident in Apollo 13 in which the crew reported hearing a thump and then 
seeing "snow f lak es" outside the window resulted in a considerable data search to de- 
termine if a current spike on one sample datum was real. A higher sampling rate 


13 



would have indicated several current spikes within 1 second as obtained through sub- 
sequent battery testing when a battery was discharged through potassium hydroxide. 
Redundancy in components, assemblies, or systems should be provided in a manner 
that permits individual testing of that component, assembly, or system. 


Manned Spacecraft Center 

National Aeronautics and Space Administration 
Houston, Texas, April 14, 1972 
914-13-00-00-72 
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